IOMMU Fixes for Linux v4.20-rc3

Including:
 
 	- Two fixes for the Intel VT-d driver to fix a NULL-ptr
 	  dereference and an unbalance in an allocate/free path
 	  (allocated with memremap, freed with iounmap)
 
 	- Fix for a crash in the Renesas IOMMU driver
 
 	- Fix for the Advanced Virtual Interrupt Controler (AVIC) code
 	  in the AMD IOMMU driver
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABAgAGBQJb+CxJAAoJECvwRC2XARrjKYoQAMWv6cWDNzr8phjTS8Lj53XN
 H2uQDCu4V7ysDrmUuN1zWn5R3MPbD3/1XlJuen7cKaI7Uwx1/ivzOi8f+MAfGEY2
 SSy/uJsGr8z0qh+QiIUyju8hK3iZe0WWntkwQ//LoJcZyF6JgpaaBwnXvU9KIkId
 m8wr38hgzYz/KoRZwMQ2rD/5wTG1AcEaR/gQC2UUaSXNmiFuh0MiHQqB46nCFUNx
 5fvpRI+Df3pqYXwC0TTic9BI5DAeZgz2j/r5BPOYorLMZm1cgSMaGvnJkGGVlxKJ
 LDcxKcvuZQbJXTtZ9mumtx6Z9sBhhCLhJcX2eJHmWA/9caSzBJsCEgzh0ZBvRhf+
 23zH0MvxP8IcddIGNzteCcr31GFXPtnLaXEJyRDJ3xuDIr4IwMwUBcvyGhzohDPQ
 G5SyNG8MP0PYvcypMARcpvn+zldGb5sZZXykrkRYY7y0jxwLBQ5P3mYjEYlGDhhN
 yHftLid9bAyoSIizSyNUlHf1NmPMamT0d/L4v96JSuC2a1fTgboXC2R7qrkzrx0+
 RH2zkEIVfITPDX6/r5zZsHEf1raRtGGnUOyvxJOkAV2zsxoCEQC1xBR8BpeyDjHn
 plfKBTCdAD8WrQKOgo4kVIgZtTGlc1bNwTgpN0N+SNTrNCsRq8a9tyoXGjGWcFxc
 C7Q67vcD4TfRxQgx0CF7
 =28EU
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull IOMMU fixes from Joerg Roedel:

 - Two fixes for the Intel VT-d driver to fix a NULL-ptr dereference and
   an unbalance in an allocate/free path (allocated with memremap, freed
   with iounmap)

 - Fix for a crash in the Renesas IOMMU driver

 - Fix for the Advanced Virtual Interrupt Controler (AVIC) code in the
   AMD IOMMU driver

* tag 'iommu-fixes-v4.20-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/vt-d: Use memunmap to free memremap
  amd/iommu: Fix Guest Virtual APIC Log Tail Address Register
  iommu/ipmmu-vmsa: Fix crash on early domain free
  iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
This commit is contained in:
Linus Torvalds 2018-11-23 11:15:27 -08:00
Родитель a03bac580a 829383e183
Коммит d88783b9c8
4 изменённых файлов: 7 добавлений и 3 удалений

Просмотреть файл

@ -797,7 +797,8 @@ static int iommu_init_ga_log(struct amd_iommu *iommu)
entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512; entry = iommu_virt_to_phys(iommu->ga_log) | GA_LOG_SIZE_512;
memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET, memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_BASE_OFFSET,
&entry, sizeof(entry)); &entry, sizeof(entry));
entry = (iommu_virt_to_phys(iommu->ga_log) & 0xFFFFFFFFFFFFFULL) & ~7ULL; entry = (iommu_virt_to_phys(iommu->ga_log_tail) &
(BIT_ULL(52)-1)) & ~7ULL;
memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET, memcpy_toio(iommu->mmio_base + MMIO_GA_LOG_TAIL_OFFSET,
&entry, sizeof(entry)); &entry, sizeof(entry));
writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET); writel(0x00, iommu->mmio_base + MMIO_GA_HEAD_OFFSET);

Просмотреть файл

@ -3075,7 +3075,7 @@ static int copy_context_table(struct intel_iommu *iommu,
} }
if (old_ce) if (old_ce)
iounmap(old_ce); memunmap(old_ce);
ret = 0; ret = 0;
if (devfn < 0x80) if (devfn < 0x80)

Просмотреть файл

@ -595,7 +595,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
pr_err("%s: Page request without PASID: %08llx %08llx\n", pr_err("%s: Page request without PASID: %08llx %08llx\n",
iommu->name, ((unsigned long long *)req)[0], iommu->name, ((unsigned long long *)req)[0],
((unsigned long long *)req)[1]); ((unsigned long long *)req)[1]);
goto bad_req; goto no_pasid;
} }
if (!svm || svm->pasid != req->pasid) { if (!svm || svm->pasid != req->pasid) {

Просмотреть файл

@ -498,6 +498,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
{ {
if (!domain->mmu)
return;
/* /*
* Disable the context. Flush the TLB as required when modifying the * Disable the context. Flush the TLB as required when modifying the
* context registers. * context registers.